[jbosstools-issues] [JBoss JIRA] (JBIDE-12016) OpenShift Wizard should warn if domain exists but there's no ssh key on local machine (domain was created in web ui)

Tue Sep 11 06:24:33 EDT 2012

    [ https://issues.jboss.org/browse/JBIDE-12016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12716606#comment-12716606 ] 

Andre Dietisheim edited comment on JBIDE-12016 at 9/11/12 6:22 AM:
-------------------------------------------------------------------

To warn of possible issues before the cloning happens, I tried to find a way to verify keys on the local machine before the cloning happens. 

The code in Apache Mina (http://mina.apache.org/) shows pretty well how the basic scheme works.
The client signs a payload using the private key and sends it to the server. The server then verifies the signature with the public key:

The client (UserAuthPublicKey#next (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/client/auth/UserAuthPublicKey.java) instantiates some providers (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/common/signature/SignatureDSA.java) that internally use java.security.Signature:

{code}
Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), (key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS);
{code}

It then builds up a buffer with a payload that contains the public key:

{code}
Buffer bs = new Buffer();
bs.putString(session.getKex().getH());
bs.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST);
bs.putString(username);
bs.putString("ssh-connection");
bs.putString("publickey");
bs.putByte((byte) 1);
bs.putString((key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS);
bs.putPublicKey(key.getPublic());
{code}

and then signs it...

{code}
bs.putBytes(verif.sign());
{code}

Signing is done using the private key:
http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/common/signature/AbstractSignature.java
{code}
signature.initSign(prvkey);
{code}

...and sends it to the server

{code}
buffer.putBytes(bs.array(), bs.rpos(), bs.available());
session.writePacket(buffer);
{code}

The server (UserAuthPublicKey#next - http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/server/auth/UserAuthPublicKey.java) 
initializes some signature providers...

{code}
Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), keyAlg);
verif.init(key, null);
...
{code}

...builds some payload...

{code}
Buffer buf = new Buffer();
buf.putString(session.getKex().getH());
buf.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST);
buf.putString(username);
buf.putString("ssh-connection");
buf.putString("publickey");
buf.putByte((byte) 1);
buf.putString(keyAlg);
buffer.rpos(oldPos);
buffer.wpos(oldPos + 4 + len);
buf.putBuffer(buffer);
{code}

...and verifies the signature

{code}
if (!verif.verify(sig)) {
   throw new Exception("Key verification failed");
}
{code}

Verifying the signaure is done using the public key:
http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/org/apache/sshd/common/signature/AbstractSignature.java
{code}
signature.initVerify(pubkey);
{code}

      was (Author: adietish):
    To warn of possible issues before the cloning happens, I tried to find a way to verify keys on the local machine before the cloning happens. 